Adoption is outrunning governance
AI agents have reached the largest companies faster than the rules for running them. By Microsoft’s own telemetry, more than 80% of Fortune 500 companies use active AI agents built with low-code or no-code tools.1 Four recent surveys measure how far governance trails that spread. They ask different questions of different people, so each one needs to be read on its own terms.
Each survey measures something different
In the table below, the middle column shows how far agents have spread in each study, and the last column shows what has not kept pace with them.
| Study | How far agents have spread | What lags behind |
|---|---|---|
| Deloitte, State of AI in the Enterprise 2026, a survey of 3,235 business and IT leaders in 24 countries2 | Close to three-quarters of companies plan to deploy agentic AI within two years | Only 21% of the companies planning to deploy report a mature model for agent governance |
| KPMG AI Quarterly Pulse, third quarter of 2026, a survey of 314 US leaders at companies with revenue of $1 billion or more3 | 62% of organizations are building, deploying or developing AI agents | 49% have set boundaries where agents may not make decisions on their own |
| Microsoft Cyber Pulse, February 2026, from Microsoft’s telemetry and a survey it commissioned of more than 1,700 data security professionals1 | More than 80% of Fortune 500 companies use active AI agents built with low-code or no-code tools | 29% of employees have turned to unsanctioned AI agents for work tasks |
| BCG, The Widening AI Value Gap, September 20254 | AI agents’ share of the value AI creates is expected to rise from about 17% in 2025 to 29% by 2028 | Only 5% of companies are “future-built” for AI, and 60% report hardly any material value |
The four results can’t be added up or charted as one trend, because their samples differ in country, company size and date, and each study counts something different. Deloitte counted plans to deploy,2 KPMG counted organizations building or running agents,3 Microsoft measured agents in active use,1 and BCG estimated where the value of AI will come from.4
Read one at a time, the studies still point the same way. In each one, the measure of adoption runs ahead of the measure of control, whether that control is a governance model, a boundary on what agents may decide alone, or a rule against tools nobody approved.
Companies sense the gap in their own operations. In Deloitte’s 2026 technology predictions, 80% of organizations consider their basic automation mature, but only 28% say so once AI agents are included.5 The cost of leaving the gap open shows up in forecasts. Gartner expects more than 40% of agentic AI projects to be canceled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls.6 Each of those causes is something a control plane exists to manage, which is why the controls need to be in place before the next wave of agents arrives.
What to do next
- CIO. Ask for a list of every agent in use, including those built with low-code tools, with a named owner for each.
- CTO. Route agent actions through one policy enforcement point, so each rule is written once and applied to every agent, whichever vendor built it.
- CIO and CTO. Agree autonomy tiers before the next rollout. Each agent’s tier should set what it may do alone and what needs a person’s approval.
Go deeper
Section 1 of The AI Control Plane Handbook sets these surveys beside an integration benchmark and an analyst forecast, and explains why coordinating models and agents has become an infrastructure problem. Slide 4 of the executive deck puts the four results on one page, with speaker notes you can present from.
Try it
Before you quote figures like these, Quote a survey figure with its weights and margin of error shows what to check first, with a notebook you can run in Colab.
Found this useful? Follow me on LinkedIn for the next one.
Working on this? Connect and tell me what you are seeing.
Read the full handbook and the executive deck online.